CVE-2026-81985: Adobe Acrobat Use After Free Vulnerability

CVE-2026-81985 Overview

Adobe Acrobat and Acrobat Reader contain a use-after-free vulnerability [CWE-416] that enables arbitrary code execution in the context of the current user. An attacker crafts a malicious PDF file and delivers it to the victim through email, web download, or file sharing. When the victim opens the file in a vulnerable version of Acrobat or Reader, the application dereferences freed memory and executes attacker-controlled code. The flaw affects both the Classic and Continuous release tracks on Windows and macOS. Adobe published the fix in security bulletin APSB26-141.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running Acrobat, enabling malware installation, data theft, and lateral movement from a single opened PDF.

Affected Products

Adobe Acrobat (Classic track)
Adobe Acrobat DC and Acrobat Reader DC (Continuous track)
Windows and macOS installations of the above products

Discovery Timeline

2026-09-08 - CVE-2026-81985 published to the National Vulnerability Database
2026-09-10 - NVD record last modified

Technical Details for CVE-2026-81985

Vulnerability Analysis

The vulnerability is a use-after-free condition in Adobe Acrobat and Acrobat Reader triggered while parsing a malicious PDF. The application frees an internal object but retains a dangling pointer that is later dereferenced during subsequent processing. Attackers control the memory contents at the freed location by shaping heap allocations through embedded JavaScript, streams, or crafted PDF objects. When the dangling pointer is used, execution transfers to attacker-controlled data. Exploitation requires user interaction: the victim must open the malicious document. The attack executes locally within the Reader process, so the resulting code runs with the current user's privileges and inherits their file system, network, and identity access.

Root Cause

The root cause is improper object lifetime management inside the PDF parser or a related component. A reference to a heap object survives beyond the object's free operation, producing a stale pointer. Adobe has not published low-level details of the affected function or object type in the public advisory APSB26-141.

Attack Vector

An attacker sends a weaponized PDF via phishing, drive-by download, messaging platforms, or shared storage. When the victim opens the file in an unpatched Acrobat or Reader build, the parser triggers the free-and-reuse sequence. Heap grooming techniques allow the attacker to place controlled data at the freed allocation, redirecting control flow to shellcode or a ROP chain. Sandbox escape is not required for user-context code execution.

A public exploit or proof-of-concept for CVE-2026-81985 is not currently available. Refer to the Adobe Acrobat Security Advisory APSB26-141 for vendor guidance.

Detection Methods for CVE-2026-81985

Indicators of Compromise

Unexpected child processes spawned by Acrobat.exe, AcroRd32.exe, or AdobeAcrobat on macOS, such as cmd.exe, powershell.exe, wscript.exe, or shell interpreters
Acrobat processes writing executable files, scripts, or scheduled task entries to disk
Outbound network connections initiated by an Acrobat process to previously unseen domains or IPs shortly after a PDF is opened
Crash dumps or Windows Error Reporting events referencing access violations inside Acrobat modules

Detection Strategies

Alert on Acrobat or Reader processes launching command interpreters or LOLBins, since legitimate PDF workflows rarely require this behavior
Hunt for PDFs containing embedded JavaScript combined with unusual object streams or malformed cross-reference tables
Correlate email gateway telemetry showing PDF attachments with subsequent endpoint process anomalies on the recipient host

Monitoring Recommendations

Enable command-line and process-tree logging on all endpoints running Adobe Acrobat or Reader
Forward endpoint, email, and proxy telemetry to a centralized analytics platform for cross-source correlation and retroactive hunting
Monitor Acrobat version inventory across the fleet to identify hosts still running vulnerable builds after the patch cycle

How to Mitigate CVE-2026-81985

Immediate Actions Required

Apply the updates listed in Adobe security bulletin APSB26-141 to all Windows and macOS endpoints running Acrobat or Reader on both the Classic and Continuous tracks
Prioritize patching for users who routinely open external PDFs, including finance, HR, legal, and executive staff
Block or quarantine inbound PDF attachments from untrusted senders at the email gateway until patching completes

Patch Information

Adobe published fixed versions in the Adobe Acrobat Security Advisory APSB26-141. Administrators should consult the advisory for the exact fixed build numbers for each release track and deploy through Adobe Update Server, Microsoft Intune, SCCM, Jamf, or the built-in updater.

Workarounds

Enable Protected View for files originating from the Internet and untrusted locations through Acrobat Preferences under Security (Enhanced)
Disable JavaScript execution in Acrobat and Reader via Preferences > JavaScript > Enable Acrobat JavaScript to reduce heap-grooming primitives
Enforce application allowlisting or WDAC policies that prevent Acrobat from launching command interpreters and script hosts

bash

# Windows registry example: disable Acrobat JavaScript for all users
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 1 /f

# Enforce Protected View for files from the Internet
reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v iProtectedView /t REG_DWORD /d 2 /f